parenthese/deploy/nginx.conf

# ─── En-têtes de sécurité ─────────────────────────────────────────────────────
#
# nginx n'hérite des add_header du niveau server que dans les location qui n'en déclarent aucun.
# Toute location qui pose son propre add_header (Cache-Control par exemple) répète donc la liste
# complète. Les politiques longues sont rangées dans des variables (map) pour ne pas les recopier.
#
# CSP de l'application (app.parenthese.io), sources autorisées :
#   script-src, connect-src  https://*.posthog.com, analytics (VITE_POSTHOG_HOST = us.i.posthog.com,
#                            extensions chargées depuis us-assets.i.posthog.com ; forme recommandée par PostHog)
#   connect-src 'self'       appels /api, /auth, /trees
#   style-src 'unsafe-inline' styles posés en ligne par React et par posthog-js
#   img-src data: blob:      aperçu d'une photo avant envoi (URL.createObjectURL), images en data:
#   font-src 'self' data:    polices servies par le site (Vite peut en inliner une petite en data:)
#   media-src blob:          lecture locale d'un fichier avant envoi
#   worker-src blob:         compression des enregistrements posthog-js
#   frame-src                'self' pour les PDF servis par /api, YouTube sans cookie, carte OpenStreetMap
#   frame-ancestors          la landing parenthese.io intègre l'app en iframe
map $host $parenthese_app_csp {
    default "default-src 'self'; script-src 'self' https://*.posthog.com; style-src 'self' 'unsafe-inline'; img-src 'self' data: blob:; font-src 'self' data:; connect-src 'self' https://*.posthog.com; media-src 'self' blob:; worker-src 'self' blob:; frame-src 'self' https://www.youtube-nocookie.com https://www.openstreetmap.org; object-src 'none'; base-uri 'self'; form-action 'self'; frame-ancestors 'self' https://parenthese.io https://www.parenthese.io";
}

# CSP de la landing (parenthese.io), sources autorisées :
#   script-src 'sha256-...'  script en ligne du <head> (animation du logo, dans index.html et en/index.html).
#                            S'il change, recalculer l'empreinte : base64(sha256(contenu exact entre
#                            <script> et </script>)), sinon l'animation ne se joue plus (sans autre effet).
#   posthog                  comme pour l'app
#   style-src 'unsafe-inline' attributs style du rendu serveur React
#   frame-src                démonstration de l'app en iframe
#   frame-ancestors 'none'   équivalent de X-Frame-Options DENY
map $host $parenthese_landing_csp {
    default "default-src 'self'; script-src 'self' 'sha256-Av5a1/yoW/tQ2ZQWqH5FnaL896Bubcs9ivdFvsKZBrU=' https://*.posthog.com; style-src 'self' 'unsafe-inline'; img-src 'self' data:; font-src 'self' data:; connect-src 'self' https://*.posthog.com; worker-src 'self' blob:; frame-src https://app.parenthese.io; object-src 'none'; base-uri 'self'; form-action 'self'; frame-ancestors 'none'";
}

# Réponses de l'API relayées (JSON, médias des familles) : intégrables seulement par l'app (PDF en iframe).
map $host $parenthese_api_csp {
    default "frame-ancestors 'self' https://parenthese.io https://www.parenthese.io";
}


# ─── app.parenthese.io ────────────────────────────────────────────────────────

server {
    listen 80;
    server_name app.parenthese.io;
    return 301 https://app.parenthese.io$request_uri;
}

server {
    # « listen ... http2 » gardé : la directive « http2 on; » demande nginx 1.25.1 ou plus, et la version
    # installée sur le VPS n'est pas écrite dans le dépôt (Ubuntu 24.04 livre la 1.24). À passer en
    # « listen 443 ssl; » + « http2 on; » une fois « nginx -v » vérifié.
    listen 443 ssl http2;
    server_name app.parenthese.io;

    ssl_certificate /etc/letsencrypt/live/app.parenthese.io/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/app.parenthese.io/privkey.pem;
    ssl_protocols TLSv1.2 TLSv1.3;

    # Hérités par les location sans add_header, c'est-à-dire les routes relayées vers l'API
    add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
    add_header Content-Security-Policy $parenthese_api_csp always;
    add_header X-Content-Type-Options "nosniff" always;
    add_header Referrer-Policy "strict-origin-when-cross-origin" always;
    add_header Permissions-Policy "camera=(), microphone=(), geolocation=(), payment=(), usb=()" always;

    gzip on;
    gzip_vary on;
    gzip_min_length 1024;
    gzip_types text/plain text/css application/json application/javascript text/xml application/xml text/javascript image/svg+xml;

    root /var/www/parenthese/frontend/dist;
    index index.html;

    location /api/ {
        rewrite ^/api(/.*)$ $1 break;
        proxy_pass http://127.0.0.1:4000;
        proxy_http_version 1.1;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        client_max_body_size 25m;
        proxy_connect_timeout 10s;
        proxy_send_timeout 30s;
        proxy_read_timeout 30s;
    }

    location /auth/ {
        proxy_pass http://127.0.0.1:4000;
        proxy_http_version 1.1;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
    }

    location /trees {
        proxy_pass http://127.0.0.1:4000;
        proxy_http_version 1.1;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        client_max_body_size 25m;
    }

    location /health {
        proxy_pass http://127.0.0.1:4000;
        proxy_http_version 1.1;
    }

    location / {
        try_files $uri $uri/ /index.html;
        add_header Cache-Control "no-cache, no-store, must-revalidate" always;
        add_header Pragma "no-cache" always;
        add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
        add_header Content-Security-Policy $parenthese_app_csp always;
        add_header X-Content-Type-Options "nosniff" always;
        add_header Referrer-Policy "strict-origin-when-cross-origin" always;
        add_header Permissions-Policy "camera=(), microphone=(), geolocation=(), payment=(), usb=()" always;
    }

    location ~* \.(js|css|png|jpg|jpeg|gif|ico|svg|woff|woff2|ttf|eot)$ {
        expires 30d;
        add_header Cache-Control "public, immutable";
        add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
        add_header Content-Security-Policy $parenthese_app_csp always;
        add_header X-Content-Type-Options "nosniff" always;
        add_header Referrer-Policy "strict-origin-when-cross-origin" always;
        add_header Permissions-Policy "camera=(), microphone=(), geolocation=(), payment=(), usb=()" always;
    }
}


# ─── parenthese.io (landing) ─────────────────────────────────────────────────

server {
    listen 80;
    server_name parenthese.io www.parenthese.io;
    return 301 https://parenthese.io$request_uri;
}

server {
    listen 443 ssl http2;
    server_name www.parenthese.io;
    ssl_certificate /etc/letsencrypt/live/parenthese.io/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/parenthese.io/privkey.pem;
    ssl_protocols TLSv1.2 TLSv1.3;
    add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
    return 301 https://parenthese.io$request_uri;
}

server {
    listen 443 ssl http2;
    server_name parenthese.io;

    ssl_certificate /etc/letsencrypt/live/parenthese.io/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/parenthese.io/privkey.pem;
    ssl_protocols TLSv1.2 TLSv1.3;

    add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
    add_header Content-Security-Policy $parenthese_landing_csp always;
    add_header X-Content-Type-Options "nosniff" always;
    add_header Referrer-Policy "strict-origin-when-cross-origin" always;
    add_header Permissions-Policy "camera=(), microphone=(), geolocation=(), payment=(), usb=()" always;
    add_header X-Frame-Options "DENY" always;

    gzip on;
    gzip_vary on;
    gzip_min_length 1024;
    gzip_types text/plain text/css application/json application/javascript text/xml application/xml text/javascript image/svg+xml;

    root /var/www/parenthese/landing/dist;
    index index.html;

    # SPA fallback
    location / {
        try_files $uri $uri/ /index.html;
        add_header Cache-Control "no-cache, no-store, must-revalidate" always;
        add_header Pragma "no-cache" always;
        add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
        add_header Content-Security-Policy $parenthese_landing_csp always;
        add_header X-Content-Type-Options "nosniff" always;
        add_header Referrer-Policy "strict-origin-when-cross-origin" always;
        add_header Permissions-Policy "camera=(), microphone=(), geolocation=(), payment=(), usb=()" always;
        add_header X-Frame-Options "DENY" always;
    }

    # Fingerprinted static assets
    location ~* \.(js|css|png|jpg|jpeg|gif|ico|svg|woff|woff2|ttf|eot)$ {
        expires 30d;
        add_header Cache-Control "public, immutable";
        add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
        add_header Content-Security-Policy $parenthese_landing_csp always;
        add_header X-Content-Type-Options "nosniff" always;
        add_header Referrer-Policy "strict-origin-when-cross-origin" always;
        add_header Permissions-Policy "camera=(), microphone=(), geolocation=(), payment=(), usb=()" always;
        add_header X-Frame-Options "DENY" always;
    }
}